domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

Check passwords against HaveIBeenPwned (#12716)

Browse source 
* Implement pwn

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Update module

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Apply suggestions mrsdizzie

Co-authored-by: mrsdizzie <info@mrsdizzie.com>

* Add link to HIBP

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Add more details to admin command

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Add context to pwn

Signed-off-by: jolheiser <john.olheiser@gmail.com>

* Consistency and making some noise ;)

Signed-off-by: jolheiser <john.olheiser@gmail.com>

Co-authored-by: mrsdizzie <info@mrsdizzie.com>
Co-authored-by: zeripath <art27@cantab.net>
This commit is contained in:
John Olheiser 2020-09-08 17:06:39 -05:00 • committed by GitHub
parent bea343ce09
commit c6e4bc53aa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
22 changed files with 309 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
cmd/admin.go
View file

@ -6,6 +6,7 @@
package cmd
import (
"context"
"errors"
"fmt"
"os"
@ -265,6 +266,13 @@ func runChangePassword(c *cli.Context) error {
if !pwd.IsComplexEnough(c.String("password")) {
return errors.New("Password does not meet complexity requirements")
}
pwned, err := pwd.IsPwned(context.Background(), c.String("password"))
if err != nil {
return err
}
if pwned {
return errors.New("The password you chose is on a list of stolen passwords previously exposed in public data breaches. Please try again with a different password.\nFor more details, see https://haveibeenpwned.com/Passwords")
}
uname := c.String("username")
user, err := models.GetUserByName(uname)
if err != nil {